Security audit

exam-study-guide-predictor

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent exam-preparation helper that reads user-provided course materials and creates study outputs, with no evidence of hidden execution, exfiltration, or privilege abuse.

Installers should expect the skill to read the course files they provide, produce an English study guide by default, and save generated outputs under /mnt/user-data/outputs/. Do not use it during a live exam or with materials you are not allowed to use.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The invocation text uses broad study-oriented trigger phrases like 'help me study for X' and 'make me a revision guide,' which can cause the agent to activate for generic education requests outside the narrowly intended exam-preparation use case. Over-broad routing can expose unrelated user materials to a skill optimized for exam prediction, increasing the chance of inappropriate handling, misleading outputs, or policy-boundary slippage around assessment assistance.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instruction 'Output in English, but read Arabic' forces a language choice without confirming user preference or documenting a necessity that overrides it. While not a direct security exploit, this can cause integrity and privacy issues if sensitive Arabic-source nuance is translated into English by default, potentially misrepresenting meaning or surfacing content in a language the user did not want.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The instruction "Output stays English" can cause the skill to disregard the language of the user's materials and likely user expectations, even when the source content is Arabic or code-switched. In an exam-preparation context, forced translation can distort professor wording, lose nuance in explicit exam cues, and increase the chance of inaccurate study guidance or misunderstood predicted questions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This markdown file directs the skill to write a generated .docx file to /mnt/user-data/outputs/, which is a user-data-affecting operation. The description does not explicitly warn the user that a file will be created in that location or call out this persistence behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The delivery instructions tell the skill to save the generated file to /mnt/user-data/outputs/ and present it, but do not include a clear warning that the skill writes files to persistent user storage. For markdown files, behaviors affecting user data should be disclosed.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.